Operator. This service is operated by Giimaa Dupont, sole proprietor operating Gima’s Piano, 547 Buena Vista Ave, Alameda, CA 94501, telephone 510-502-9945. For privacy requests, contact [email protected]. Effective date: August 25, 2026.

Children’s Privacy

Gima’s Piano is used by children, including children under 13, together with a parent or legal guardian.

A parent or legal guardian creates and controls the account. Signup is for a parent or legal guardian, who confirms they are at least 18 and the child’s parent or guardian. We ask the adult to provide their own name, email, and password; children should not create accounts or submit contact or payment information. We use the parent’s email to create and manage the account and to obtain and record consent.

We do not create a child profile or store a child’s learning activity until a parent verifies consent. A parent verifies consent by completing our paid subscription — a real payment transaction that is sent to and confirmed with the parent (the account holder) — after we have shown and emailed the parent this notice and the parent has confirmed they are the parent or legal guardian and made explicit consent choices. As an alternative, a parent may instead complete and return a signed consent form (photo or PDF) that we review and approve. Until consent is verified this way, a child’s lesson progress, quiz results, and practice scores are not saved to our servers.

Free preview. A child may try free sample lessons with no account. During the preview we create no child profile, save no progress on our servers, use no AI, and run no behavioral or advertising analytics on the pages a child uses; scoring runs on the device. We keep only short technical and security logs, the network information our content-delivery provider needs to deliver lesson video, and an aggregate daily count of preview practice starts (a date and a number, with no identifiers).

What we collect for a consented child account. The child’s lesson progress, quiz results, and practice scores, and an age range (not a date of birth).

How we use a child’s information. To run the lessons, record and show progress to the parent and child, decide which lesson or practice to show next, and provide support. We do not use children’s information for third-party or behavioral advertising, and we do not sell personal information.

Our record of consent. We record, against your account, the version and date of the notice you were shown, your consent choices, your name, your account email, your confirmation that you are the parent/guardian, and — for payment consent — the payment/subscription and customer identifier from our payment processor (never your card details). For a signed form, we securely retain the form and your signature. These records are stored securely and are not publicly accessible.

Audio. Microphone practice is analyzed on the device. Raw audio recordings are not uploaded to or stored on our servers.

Live group classes. Live group classes are not available to child accounts at this time. If we offer a class in which a child participates, we will first ask the parent’s separate permission before any of the child’s display name, audio, or video is shared with our video-meeting provider.

AI-generated feedback is currently turned off. We do not send any practice or quiz information to AI providers, and we have deleted the child data we controlled at those providers.

Parental choices. A parent or legal guardian may contact [email protected] to review the information we have collected from their child, ask us to delete it, or stop further collection. Before acting, we confirm you control the account — by sending a confirmation link to the account’s email address or by asking you to sign in — and match the request to the account’s consent record; we respond within 30 days (acknowledging within 7 business days where possible). When we send a review of your child’s information, we deliver it securely (for example, an encrypted or password-protected file or a secure link), not as an ordinary email attachment. If a refund, chargeback, or subscription cancellation ends the payment on which consent was based, we stop further collection of your child’s information unless another valid consent record remains. Deleting the account removes the child’s stored learning data.

If you believe we collected information from a child in error, contact [email protected] and we will delete it.

How long we keep information

• We keep only the most recent practice records per child, and we automatically delete detailed practice records older than 365 days.
• After 24 months of account inactivity we delete the child’s learning data, withdraw the consent on the account, and delete the signed consent form; a returning family must complete a new notice and consent before any child activity is saved again. We keep only a minimal internal record that consent expired.
• We keep a child’s learning data while the account is active, and delete it on a verified parental request or when the account is deleted.
• The aggregate preview counter (date and number only) is kept 90 days.
• Login-security tokens are kept for a few minutes.
• Parent contact and account information is kept while the account is active and for 30 days after the account is closed, then deleted — except records we must keep longer for payment, tax, fraud-prevention, consent-evidence, or legal reasons.
• Technical and security logs we control are kept for up to 30 days (longer only for a documented security incident); our host and providers keep their own logs for periods they set.
• Our host (NameHero) keeps rolling nightly and weekly backups. When we delete data it is removed from our live systems immediately and remains only in those backups until they rotate out of the backup schedule, after which it is gone from backups too.
• We keep our record of consent (and any signed consent form) while the account is active.

Service providers

We share information only as needed to run the service, and we do not sell personal information.

• NameHero — hosts the website and the database that stores accounts and (consented) learning data.
• Cloudflare — delivers pages and lesson video (Cloudflare Stream) and provides security. Cloudflare processes visitors’ IP addresses and request information to deliver pages and video. We do not use Cloudflare’s optional web analytics.
• SureCart and Stripe — process the parent’s subscription payment; the completion of that payment is also how a parent verifies consent. We never receive or store card details.
• Google — provides optional “Sign in with Google” for login, and Google Analytics on our parent-facing marketing pages only (not on the pages children use).
• FluentCRM — manages our email lists; it runs on our own hosting and does not send parents’ data to an outside company for this purpose.
• Brevo — delivers our email to parents (such as account and consent notifications). We do not currently send emails containing a child’s progress or scores.
• Zoom — hosts optional live group classes for parents. Live classes are not available to child accounts at this time; if we offer a class in which a child participates, we will first ask the parent’s separate permission.
• Apple — distributes our iOS app through the App Store and provides Sign in with Apple for parent accounts, and supports optional on-device notifications.
• Fly.io, OpenAI, and Pinecone — our AI-feedback providers. This feature is currently turned off, and we have deleted the child data we controlled at these providers; any operational logs they keep age out under their own retention terms.

Contact

Questions or requests: [email protected], 510-502-9945, 547 Buena Vista Ave, Alameda, CA 94501.